Digital forensics with Kali Linux : perform data acquisition, digital investigation, and threat analysis using Kali Linux tools

Digital forensics with Kali Linux perform data acquisition, digital investigation, and threat analysis using Kali Linux tools

Learn the skills you need to take advantage of Kali Linux for digital forensics investigations using this comprehensive guide About This Book Master powerful Kali Linux tools for digital investigation and analysis Perform evidence acquisition, preservation, and analysis using various tools within Ka...

Descripción completa

Detalles Bibliográficos
Otros Autores: Parasram, Shiva V. N., author (author)
Formato: Libro electrónico
Idioma:Inglés
Publicado: Birmingham, England : Packt 2017.
Edición:First edition
Materias:
Kali Linux.
Computer crimes > Investigation.
Computer networks > Security measures.
Ver en Biblioteca Universitat Ramon Llull:https://discovery.url.edu/permalink/34CSUC_URL/1im36ta/alma991009631649506719
Tabla de Contenidos:
  • Cover
  • Title Page
  • Copyright
  • Credits
  • Disclaimer
  • About the Author
  • About the Reviewers
  • www.PacktPub.com
  • Customer Feedback
  • Table of Contents
  • Preface
  • Chapter 1: Introduction to Digital Forensics
  • What is digital forensics?
  • Digital forensics methodology
  • A brief history of digital forensics
  • The need for digital forensics as technology advances
  • Commercial tools available in the field of digital forensics
  • Operating systems and open source tools for digital forensics
  • Digital evidence and forensics toolkit Linux
  • Computer Aided INvestigative Environment
  • Kali Linux
  • The need for multiple forensics tools in digital investigations
  • Anti-forensics: threats to digital forensics
  • Encryption
  • Online and offline anonymity
  • Summary
  • Chapter 2: Installing Kali Linux
  • Software version
  • Downloading Kali Linux
  • Installing Kali Linux
  • Installing Kali Linux in VirtualBox
  • Preparing the Kali Linux virtual machine
  • Installing Kali Linux on the virtual machine
  • Partitioning the disk
  • Exploring Kali Linux
  • Summary
  • Chapter 3: Understanding Filesystems and Storage Media
  • Storage media
  • IBM and the history of storage media
  • Removable storage media
  • Magnetic tape drives
  • Floppy disks
  • Evolution of the floppy disk
  • Optical storage media
  • Compact disks
  • Digital versatile disks
  • Blu-ray disk
  • Flash storage media
  • USB flash drives
  • Flash memory cards
  • Hard disk drives
  • IDE HDDs
  • SATA HDDs
  • Solid-state drives
  • Filesystems and operating systems
  • What about the data?
  • Data states
  • Metadata
  • Slack space
  • Data volatility
  • The paging file and its importance in digital forensics
  • Summary
  • Chapter 4: Incident Response and Data Acquisition
  • Digital evidence acquisitions and procedures
  • Incident response and first responders.
  • Documentation and evidence collection
  • Physical evidence collection and preservation
  • Physical acquisition tools
  • Order of volatility
  • Chain of Custody
  • Powered-on versus powered-off device acquisition
  • Powered-on devices
  • Powered-off devices
  • Write blocking
  • Data imaging and hashing
  • Message Digest (MD5) hash
  • Secure Hashing Algorithm (SHA)
  • Device and data acquisition guidelines and best practices
  • Summary
  • Chapter 5: Evidence Acquisition and Preservation with DC3DD and Guymager
  • Drive and partition recognition in Linux
  • Device identification using the fdisk command
  • Maintaining evidence integrity
  • Using DC3DD in Kali Linux
  • File-splitting using DC3DD
  • Verifying hashes of split image files
  • Erasing a drive using DC3DD
  • Image acquisition using Guymager
  • Running Guymager
  • Acquiring evidence with Guymager
  • Hash verification
  • Summary
  • Chapter 6: File Recovery and Data Carving with Foremost, Scalpel, and Bulk Extractor
  • Forensic test images used in Foremost and Scalpel
  • Using Foremost for file recovery and data carving
  • Viewing Foremost results
  • Using Scalpel for data carving
  • Specifying file types in Scalpel
  • Using Scalpel for file carving
  • Viewing results of Scalpel
  • Comparing Foremost and Scalpel
  • Bulk_extractor
  • Forensic test image for Bulk_extractor
  • Using Bulk_extractor
  • Viewing results of Bulk_extractor
  • Summary
  • Chapter 7: Memory Forensics with Volatility
  • About the Volatility Framework
  • Downloading test images for use with Volatility
  • Image location
  • Using Volatility in Kali Linux
  • Choosing a profile in Volatility
  • The imageinfo plugin
  • Process identification and analysis
  • The pslist command
  • The pstree command
  • The psscan command
  • The psxview plugin
  • Analyzing network services and connections
  • The connections command.
  • The connscan command
  • The sockets plugin
  • DLL analysis
  • The verinfo command
  • The dlllist plugin
  • The getsids command
  • Registry analysis
  • The hivescan plugin
  • The hivelist plugin
  • Password dumping
  • Timeline of events
  • The timeliner plugin
  • Malware analysis
  • Summary
  • Chapter 8: Autopsy - The Sleuth Kit
  • Introduction to Autopsy - The Sleuth Kit
  • Sample image file used in Autopsy
  • Digital forensics with Autopsy
  • Starting Autopsy
  • Creating a new case
  • Analysis using Autopsy
  • Sorting files
  • Reopening cases in Autopsy
  • Summary
  • Chapter 9: Network and Internet Capture Analysis with Xplico
  • Software required
  • Starting Xplico in Kali Linux
  • Starting Xplico in DEFT Linux 8.2
  • Packet capture analysis using Xplico
  • HTTP and web analysis using Xplico
  • VoIP analysis using Xplico
  • Email analysis using Xplico
  • SMTP exercise using Wireshark sample file
  • Summary
  • Chapter 10: Revealing Evidence Using DFF
  • Installing DFF
  • Starting the DFF GUI
  • Recovering deleted files with DFF
  • File analysis with DFF
  • Summary
  • Index.

Ejemplares similares